HubSpot AI security FAQ: what CTOs and CIOs need to know

Most enterprise teams already use AI somewhere in sales, marketing and service.

The question for CTOs and CIOs is where customer data goes when they do. External AI tools often sit outside your data protection controls, so every prompt containing a customer record becomes an unassessed data transfer.

HubSpot's built-in AI features run inside the platform your team already governs. That narrows the risk. It still leaves decisions for your team: which features to switch on, what data they can reach, who can use them, and how outputs are checked before a customer sees them.

This FAQ covers how HubSpot handles data in its AI features, where the remaining risks sit, and what IT leaders should settle before rolling AI out across the CRM.

Frequently asked questions: ensuring security and compliance with HubSpot AI

Where is customer data processed and stored in HubSpot AI features, and how is it protected?

Customer data used by HubSpot's AI features is held in HubSpot's own infrastructure, which runs on AWS. Accounts are hosted in the US by default, and HubSpot has offered an EU data centre in Frankfurt since 2021 for customers who need their data held in Europe. Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or 1.3.

Some AI features send limited data to a third-party model provider, such as OpenAI, to generate an output. HubSpot states that these providers process the data only to deliver the feature, hold it temporarily, and are contractually barred from training their models on HubSpot customer data.

How does HubSpot protect sensitive customer information during AI processing?

HubSpot's protections fall into four groups:

• Platform security. Encryption at rest and in transit, SAML single sign-on on Enterprise tiers, and two-factor authentication that admins can enforce for every user.
• Access control. User permissions, team-based record access and field-level permissions decide what each person can see. 
• AI settings. Admins can manage which AI features are available in the account and what data AI tools can access.
• Provider terms. Third-party model providers are contractually barred from training on customer data. Separately, customers control whether their data is used to improve HubSpot's own models, and can opt out.

What are the key security risks with HubSpot AI, and how are they mitigated?

Most of the risk sits in how AI is configured and used inside your portal. Four areas account for most of it.

1. Data exposure through broad access. An AI feature that can read every property can surface data a user should not see, in a summary or a draft. Review permissions and restrict what AI tools can reach before switching features on.
2. Compromised accounts. A stolen login gives an attacker the same AI tools your staff use. Require single sign-on where your tier supports it and enforce two-factor authentication for every user.
3. Third-party access. Every integration and every partner with portal access extends your attack surface. Vet integrations before installing them, and choose partners whose own controls are independently certified. Huble is certified to ISO/IEC 27001:2022, ISO 9001:2015 and ISO/IEC 42001:2023.
4. Unreviewed AI output. Generated emails, summaries and agent replies can be wrong. Set a review step for anything customer-facing, and a stricter one in regulated sectors.

Does data stay within HubSpot systems or get shared with providers like OpenAI?

Both, depending on the feature. Core CRM data stays in HubSpot's infrastructure. When a feature needs a large language model, for example to summarise a call transcript or draft an email, the relevant data is sent to a third-party provider to generate the output. HubSpot states that the provider holds it only temporarily, under HubSpot's security and privacy requirements, and cannot use it for training.

For a vendor assessment, ask HubSpot for its current AI subprocessor list and where each provider processes data. That answer matters most if your account is hosted in the EU.

How does HubSpot ensure compliance with privacy laws like GDPR and CCPA?

HubSpot provides the controls, and compliance depends on how you use them. Its GDPR tools cover lawful basis tracking, consent and subscription management, and data deletion requests.

HubSpot offers a data processing agreement, provides a SOC 2 Type 2 report on request, and publishes a SOC 3 report; its cloud hosting providers are ISO/IEC 27001 certified. 

For AI specifically, check three things: that your privacy notices cover AI processing of customer data, that your data protection impact assessment includes HubSpot's AI features, and that no processing leaves the region your contracts require.

Read more:Our guide to GDPR for HubSpot users

What specific security measures address AI-related risks?

• Admin control over which AI features are enabled
• Admin control over what data AI tools can access
• An opt-out from customer data being used to improve HubSpot's models
• Contractual limits on third-party providers: temporary processing, no training
• Encryption in transit and at rest
• Existing user, team and field-level permissions

What is HubSpot's plan if AI-related data issues arise?

HubSpot's security incident process covers its AI features alongside the rest of the platform, and its breach-notification commitments sit in the data processing agreement. 

Your own plan matters as much. Decide in advance who can switch an AI feature off, who reviews its recent outputs, and who tells customers if something goes wrong.

How does HubSpot’s AI security compare to other platforms?

The major CRM vendors now make similar baseline commitments: encryption, contractual limits on model providers, and admin controls over AI features. The differences are in the detail, so compare like for like. Ask which providers process your data, for how long, in which region, and what you can switch off.

HubSpot's practical advantage for most mid-market and enterprise teams is that AI runs on the same data model and permissions as the rest of the CRM, so there is one set of controls to govern rather than a separate AI layer.

Read more: Our CRM AI comparison

What should IT leaders decide before switching on HubSpot AI features?

Six decisions cover most of the governance work:

1. Which AI features and agents are in scope, and for which teams.
2. What data each feature can read, including sensitive properties.
3. Whether to opt out of your data improving HubSpot's models.
4. Where human review is required before an output reaches a customer.
5. How AI use is monitored once it is live.
6. Who owns the AI settings after go-live.

Most of these depend on the state of your CRM data. If records are duplicated, unowned or carry sensitive fields nobody has classified, fix that first. Link: Is your CRM data ready for AI? (/blog/is-your-crm-data-ready-for-ai).

Why AI security and compliance matter for enterprises using HubSpot

The risks of mishandling AI

AI tools rely on customer data, much of it personal or commercially sensitive and covered by regulations such as the GDPR and the CCPA. Mishandling it creates regulatory exposure and damages customer trust.

In healthcare and financial services the stakes are higher. A breach involving medical or financial records can do lasting damage to an organisation's reputation and operations.

Read more: HubSpot for regulated healthcare data

Key security and compliance challenges with AI in HubSpot

Below are the areas where risk tends to arise, and what to do about each. For platform-level security, see HubSpot security and compliance.

1. Data privacy and storage. AI tools analyse personal data, behavioural patterns and transaction history. Confirm your hosting region meets your regulatory requirements, and check whether any AI processing crosses borders.

2. Bias and ethical use. AI-driven lead scoring and automation reflect the data they learn from. Understand how each feature reaches its output, and review results periodically for bias.

3. Cross-border data transfers. Global teams should map data flows and confirm a lawful transfer mechanism, such as Standard Contractual Clauses, is in place where data leaves its region.

4. Integrations and APIs. Integrations widen the attack surface. Vet each vendor's security practices and limit the data shared through each connection.

5. Changing regulation. AI regulation is still moving, including the EU AI Act. Review internal policies when new obligations take effect.

Take the next step toward secure AI adoption

To safely integrate AI, businesses must take action to secure data, ensure transparency in AI decisions, and manage third-party risks. Staying up to date with evolving privacy laws is also crucial to avoid penalties and protect customer trust.

HubSpot's AI tools are built with strong security and compliance features, making it easier to protect sensitive data. Working with a HubSpot solutions partner like Huble helps ensure your business successfully navigates these challenges. 

If you’re ready to explore how to implement secure and compliant AI solutions tailored to your needs, reach out to our team today.